General
- Target Order List.exe
- Size 307KB
- Sample220322-ddbjasece6
- SHA256 f35b19f498e527a1a8eca51ec82221c55c2f969efb59b2c0b6cff0f3e0e852f6
- MD5 299dcbe8684be9ea1e264328599a8e91
- SHA1 47af82340b7a3f8ab0a1868c116659b188f98ed6
- SHA512 b6383c1dea1e8c5a0bda551e701f8e58fa0939f1f9db12f3bea494205aaa9fdd3774981dabff4c453cfc28719d7767a4f8aeb676221fd702a9bd58a73ce26731
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Order List.exe
Resource
win7-20220311-en
Malware Config
Extracted
-
xloader
-
2.5
-
mwfc
-
a-great-intl-voip-phones.zone
-
police-trust-security.com
-
415391.com
-
coi-sl.com
-
liming-steel.com
-
criticalracetheoryexplained.com
-
pintoent.com
-
columbusrx.com
-
clarktribe.net
-
texasforblanchard.com
-
musical.voyage
-
priyamblogs.com
-
employbridge.works
-
americanchessmaster.com
-
australiaaddictioncenters.com
-
drkell-yann.xyz
-
barryisdaner.com
-
frankkystein.art
-
aromatoto7.com
-
alsuwal.com
-
dmsolutionsco.com
-
learnwithvr.net
-
bigsouthfiresafety.com
-
atthelastmoment.com
-
ktnpan.xyz
-
xinhuishaoyu.com
-
humanlydivine.com
-
exitin90.com
-
wzly.top
-
blockzcoin.com
-
edm69.net
-
bewitchedkit.com
-
alpeshpate.com
-
realbeaches.com
-
bluejaerial.com
-
amazonjp-securities.net
-
forbeautii.com
-
kincsemto.net
-
playandwin-with-o-tentic.com
-
herauniversal.com
-
acs-storage.com
-
riulaza.com
-
bedrocksolution.net
-
xn--latamazulea-beb.com
-
deniyayatea.com
-
bubbledenterprise.com
-
ternopil.agency
-
freeminingboxes.com
-
suddennnnnnnnnnnn35.xyz
-
firstparkcondos.com
-
starpointeartsacademy.com
-
3ptsstore.com
-
cryptocurrencyscamreport.com
-
helennbendiss47.xyz
-
intergoldenstateautosales.com
-
lsmith.xyz
-
cuantiao.com
-
xn--z92b76hzfnc1y211an8i78t.com
-
noon21-203.com
-
boardsnourhood.com
-
toddlyonsfishing.com
-
levancanh.xyz
-
siteahan.com
-
winsportgame.club
-
malagainvestments.com
Targets
-
- Target Order List.exe
- Size 307KB
- SHA256 f35b19f498e527a1a8eca51ec82221c55c2f969efb59b2c0b6cff0f3e0e852f6
- MD5 299dcbe8684be9ea1e264328599a8e91
- SHA1 47af82340b7a3f8ab0a1868c116659b188f98ed6
- SHA512 b6383c1dea1e8c5a0bda551e701f8e58fa0939f1f9db12f3bea494205aaa9fdd3774981dabff4c453cfc28719d7767a4f8aeb676221fd702a9bd58a73ce26731
- MD5 SHA1 SHA512
-
Xloader Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext